I was reading this:
http://msdn.microsoft.com/en-us/library/tswxhw92(VS.80).aspx
The first sentence says: "Asymmetric private keys should never be stored verbatim or in plain text on the local computer."
What's the problem with this? And how does a key container solve it.
The reason I'm asking is that I want to generate an asymmetric key pair. The application I'm writing will encrypt information it sends back to me with the public key. I was thinking of storing the public/private key pair in our source control system so that it gets backed up. Shouldn't I be doing that? If not, how should I store the private key so that it can be reliably backed up?
Thanks. -scott
Update: Does 'never' in the quoted sentence really mean never. Or does it mean I shouldn't be storing keys to source control unless I'm not prepared to take the risk that a hacker could potentially retrieve the keys from our source control system or from a backup taken from it.
Yes, the "never" in the quoted sentence really does mean never.
If the key is stored in plaintext, then anyone with access to that file can read or duplicate your key, then use it to impersonate you. If you display that file on-screen for whatever reason (looking up the key, open the wrong file, editing other information in the file, etc.), then anyone walking past can see it, potentially memorize it, and use it to impersonate you.
A private crypto key is a non-shared secret. If you don't keep it non-shared and secret, it can't do its job properly.